EUVD-2026-22562
GHSA-vmwf-m9c5-3jvc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
6DescriptionCVE.org
Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Information disclosure in Microsoft .NET 8.0, 9.0, 10.0, and Visual Studio 2022 allows unauthenticated remote attackers to access sensitive data through improper neutralization of special elements. This spoofing vulnerability (CWE-138) enables attackers to bypass authentication mechanisms and extract high-confidentiality information over the network with low attack complexity. No active exploitation confirmed (not in CISA KEV), but the network-accessible, no-authentication-required attack profile presents immediate risk for internet-facing .NET applications. Vendor patches available for all affected versions.
Technical ContextAI
This vulnerability exploits CWE-138 (Improper Neutralization of Special Elements) within the .NET runtime framework and Visual Studio 2022 development environment. The flaw affects the .NET 8.0, 9.0, and 10.0 runtime branches, as well as Visual Studio 2022 versions 17.12 and 17.14. Special element neutralization weaknesses typically involve improper handling of control characters, escape sequences, or delimiter characters that can alter application logic. In the context of .NET authentication and identity subsystems, attackers can craft inputs containing special elements that bypass input validation or authentication checks, leading to spoofing attacks. The CPE data identifies Microsoft .NET runtime versions across three major release branches and two Visual Studio 2022 release channels as vulnerable, indicating a fundamental flaw in shared authentication or input handling components across the .NET ecosystem.
RemediationAI
Immediately upgrade to patched versions: .NET 10.0.6 or later for 10.0 branch deployments, .NET 9.0.15 or later for 9.0 branch deployments, .NET 8.0.26 or later for 8.0 branch deployments, Visual Studio 2022 version 17.14.30 or later for 17.14 installations, and Visual Studio 2022 version 17.12.19 or later for 17.12 installations. Microsoft has released vendor-confirmed patches for all affected product versions through the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178. Organizations should prioritize patching internet-facing .NET applications and API endpoints first, followed by internal systems and developer workstations running Visual Studio 2022. No workarounds have been published; upgrading to fixed versions is the only confirmed mitigation. Verify successful patch deployment by checking runtime version with 'dotnet --version' command and Visual Studio version through Help > About Microsoft Visual Studio menu.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today